Key leaked in May let attackers ship malicious LiteLLM release

The latest:

An unrevoked master key, accidentally committed to a public GitHub repository on May 27, 2026, gave an attacker the access needed to publish a malicious build of LiteLLM five months later, the project said Friday. Engineers Oliver Jensen and Mateo Wang said the exposed commit was force-pushed over and the key flagged for revocation, but the revocation never happened.

Details:

• The entry point: LiteLLM said a configuration file pushed to the public LiteLLM-Labs/lite-harness repository contained the master key to a deployment of its Agent Platform, the open-source tool it uses to orchestrate agents. The error was spotted quickly, but only some of the exposed keys were actually revoked.
• The token theft: On October 10, 2026, an attacker operating from 69.48.229.143 used the live key to reach the Agent Platform and extract a GitHub CLI OAuth token, according to LiteLLM. The token was tied to a GitHub organization owner and, by the maintainers’ own account, was not scoped down.
• The harvesting runs: Between 10:11 and 10:12 p.m. UTC that night, commits landed on throwaway branches in BerriAI/litellm and BerriAI/litellm-auto, running workflows that captured OAuth tokens belonging to two engineers with maintainer privileges and sent them to a webhook.site endpoint. Both runs were deleted minutes later.
• The pipeline switch: On October 21 between 10:08 and 11:08 a.m. UTC, the attacker overrode branch protection and repointed the release pipeline at a lookalike repository, Berri-AI/litellm, rather than the real BerriAI/litellm.
• The relaxed control: LiteLLM said releases normally require an authorized engineer plus approval from an account locked to a physical device in its office. That control was loosened earlier in the week to speed releases and bugfix backports, letting any two engineers trigger and approve a build.
• The publication: Version 1.107.0 reached PyPI between 11:39 and 11:40 a.m. UTC, with Docker Hub and GHCR images following at 11:46 a.m. Production and staging run records were deleted minutes later. Upwind researcher Lidor Machluf reported the supply chain attack at 12:06 p.m.
• The takedowns: PyPI quarantined 1.107.0 at 1:23 p.m. UTC, and Docker Hub tags v1.107.0, latest, main-latest and main-stable were removed or repointed to verified clean images. LiteLLM said it is now revoking every token tied to every internal system and vendor platform.
• Socket’s findings: Socket researcher Karlo Zanki said two malicious commits each added a workflow at .github/workflows/cache.yml, pushed on October 10 and October 12 to short-lived branches named ci-tmp-<hex> that were created, used and deleted within minutes, leaving almost nothing in ordinary repository history.
• The scope of secrets: The October 12 run widened collection to keys for Anthropic, OpenAI, AWS Bedrock, Tavily and GitGuardian’s secret-scanning tenant, plus Playwright storage state, PostgreSQL connection details, and Redis endpoint and password, Socket said. Data went to two webhook.site endpoints.
• The payload: Microsoft Security Research said files in 1.107.0 executed when Python started, pairing a credential stealer targeting developer tools, cloud environments and browsers with a Unix backdoor fetching attacker-supplied code hourly. Exfiltration went to litellm.dev/healthcheck, a domain registered October 13, 2026.

Background:

LiteLLM is a widely used open-source gateway for routing requests to large language model providers, distributed through PyPI, Docker Hub and GHCR. Its placement at the entry point of AI application stacks means a compromised release reaches machines holding inference API keys and cloud credentials.

Between the lines:

The attacker held an organization owner token and could have removed the two-engineer release rule outright, but used it instead; maintainers suspect that was to avoid detection. Two harvested credentials sharpen that reading: a GitGuardian key offers visibility into the secret-scanning alerts that would expose the intrusion, and Playwright storage state allows authenticated Linear access without a password or multi-factor check, Socket said.

What’s next

Watch whether LiteLLM completes the token revocation sweep it described, and whether Microsoft or Socket publish removal guidance for the startup components that survive deletion of the application directory alone.